
Benchmark Attacks and Defenses – There is a growing need for legal practioners and policy makers to understand how adversarial ML differs from traditional software attacks in ways that may inform how laws are interpreted and enforced. ML researchers can bring clarity to the situation by helping to prioritize the attacks and defenses they publish. This will both help inform the development of appropriate standards of care for systems that use machine learning, and provide practical guidance to engineers.
In this spirit, whenever researchers publish a new defense against an attack, they might consider using tools like cleverhans (See [1]}) , IBM's adversarial robustness toolkit [2]} and report shortcomings. The community should expand and invest in benchmarking efforts such as RobustML (see [3]}). We found [4]}, where defenses are stack ranked, useful to think about the progress of defenses in perturbation attacks.
Benchmarks alone aren't sufficient: we also think there is a need for a framework to assess risk and prioritize adversarial ML threats realistically. Attackers need not perform perturbation attacks to evade ML systems as documented by [5]}. To address this we believe the ML community can take inspiration from threat modeling from software community DREAD (see [6]}) to prioritize software threats. It rates attacks based on the potential for Damage, Reliability of attack, the ease which an attacker can launch the Exploit, the scope of Affected users, and the ease with which an attacker can Discover the attack.

Architect for forensics – ML systems are currently not built with forensics in mind. From a legal perspective, forensics can lend clues to attack attribution and hence eventual prosecution. ML researchers should be thinking proactively about how to architect systems so that investigations are possible, including mechanisms to alert when the system is under adversarial attack, recommend appropriate logging, construct playbooks for incident response during an attack and formulate remediation plan to recover to from the adversarial attack.

Take into account civil liberties - Deployed ML systems have the ability to impact civil liberties and basic human rights such as freedom of expression and privacy. For instance, ML researchers should anticipate that oppressive governments could seek backdoors in consumer ML systems, as demonstrated by [7]}, facilitate censorship and out political dissidents. On the same note, researchers must also think about the dual use of adversarial examples i.e. the benefits of adversarial examples. For example, dissidents in a totalitarian state should be able to evade facial detection using 3D printed glasses as shown by [8]}. ML researchers should do their best to anticipate how ML systems and attacks can be used for the benefit and detriment of individuals.

